IKEv2/IPSEC "Road Warrior" VPN Tunneling?

Karl Denninger

unread,

Apr 11, 2013, 6:31:37 PM4/11/13

to

Is there a "cookbook" for setting this up? There are examples for
setting up a tunnel between two fixed-address networks (e.g. a remote
LAN that needs to be "integrated" with a central LAN over IPSec but I
can't find anything addressing the other situation -- remote user(s)
where the connecting IPs are not known in advance, such as a person with
a laptop or smartphone in a random hotel.

(And is there a better list for this in the freebsd-* paradigm for the
question?)

--
-- Karl Denninger
/The Market Ticker ®/ <http://market-ticker.org>
Cuda Systems LLC
_______________________________________________
freebsd...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stabl...@freebsd.org"

Willy Offermans

unread,

Apr 17, 2013, 5:57:19 AM4/17/13

to

Hello Karl and FreeBSD friends,

I recall having read about racoon and roadwarrior. Have a look to
/usr/local/share/examples/ipsec-tools/, if you have installed it. I'm also
planning to install this on my server. However I have only little time at
the moment. I'm also looking for examples of configuration files to work
with.

Please keep us informed about your progress.

--
Met vriendelijke groeten,
With kind regards,
Mit freundlichen Gruessen,

Willy

*************************************
Dr. W.K. Offermans
CAT Fellow
CAT Catalytic Center
Institut für Technische und Makromolekulare Chemie
RWTH Aachen
Worringerweg 1, Raum 38C-150
D-52074 Aachen, Germany
Phone: +49 241 80 28592
Fax: +49 241 80 22593
Home: +31 45 544 49 44
Mobile: +31 681 15 87 68
e-mail: Wi...@Offermans.Rompen.nl
e-mail: Willy.O...@CatalyticCenter.RWTH-Aachen.de

Matthieu Volat

unread,

Apr 17, 2013, 3:05:47 PM4/17/13

to

On Thu, 11 Apr 2013 17:31:37 -0500
Karl Denninger <ka...@denninger.net> wrote:

> Is there a "cookbook" for setting this up? There are examples for
> setting up a tunnel between two fixed-address networks (e.g. a remote
> LAN that needs to be "integrated" with a central LAN over IPSec but I
> can't find anything addressing the other situation -- remote user(s)
> where the connecting IPs are not known in advance, such as a person with
> a laptop or smartphone in a random hotel.
>
> (And is there a better list for this in the freebsd-* paradigm for the
> question?)
>

Sorry for answering this late,

As mentionned in another answer, you can start with the roadwarrior server/client configuration in ipsec-tools examples. To work with FreeBSD, the phase1-up.sh and phase1-down.sh scripts must be customized.

I've attached both scripts, tell me if it does not work, I'll upload them somewhere (maybe propose them for inclusion in the port tree?)

--
Matthieu Volat <ma...@alkumuna.eu>

VANHULLEBUS Yvan

unread,

May 13, 2013, 9:44:15 AM5/13/13

to

On Wed, Apr 17, 2013 at 11:57:19AM +0200, Willy Offermans wrote:
> Hello Karl and FreeBSD friends,

Hi all.

> I recall having read about racoon and roadwarrior. Have a look to
> /usr/local/share/examples/ipsec-tools/, if you have installed it. I'm also
> planning to install this on my server. However I have only little time at
> the moment. I'm also looking for examples of configuration files to work
> with.

First, ipsec-tools is for IKEv1 only, as the subject of the original
mail talks about IKEv2.

For IKEv1 (with ipsec-tools), the simplest way to do this would be to
create a remote "anonymous" and a sainfo "anonymous" section, with
"generate_policy" set to on: racoon will negociate phase 1 / phase 2,
then will generate SPD entries from peer's proposal.

Of course, this means that you'll have to trust what your peers will
negociate as traffic endpoints !

If you have some more time to spend on configuration (recommanded !),
you can specify traffic endpoints for the sainfo section: valid
endpoints (which match the sainfo) negociated by peer will work as
described upper, and other traffic endpoints will not negociate, as
racoon won't find any related sainfo.

Yvan.

Karl Denninger

unread,

May 13, 2013, 9:56:09 AM5/13/13

to

I have successfully configured StrongSwan for IPSEC/IKEv2 and have it
operating both with Windows clients and also with the BlackBerry Z-10.
It is fast and works very well; I went for the current source directly
rather than the port as I wanted to enable a number of options.

If readers believe there's value in posting the "recipe" I used here let
me know.

--
Karl Denninger
ka...@denninger.net
/Cuda Systems LLC/

Sami Halabi

unread,

May 13, 2013, 10:36:38 AM5/13/13

to

Please share the confs.

Sami

Karl Denninger

unread,

May 13, 2013, 5:31:03 PM5/13/13

to

> %SPAMBLOCK-SYS: Matched [@freebsd.org+], message ok

Here's a link to a rather long post on setting it up that I put up on my
blog that pretty much walks through the details.

http://market-ticker.org/akcs-www?post=220395

The configuration for StrongSwan looks like this:

# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
# strictcrlpolicy=yes
# uniqueids = no

# Add connections here.

# Sample VPN connections

conn %default
keyingtries=1
keyexchange=ikev2

conn BB10
left=%any
leftsubnet=0.0.0.0/0
right=%any
rightsourceip=192.168.2.0/24
rightid=m...@email.address
rightauth=psk
leftauth=pubkey
leftcert=my-host-certificate.pem
auto=add

conn Win7
left=%any
leftsubnet=0.0.0.0/0
leftauth=pubkey
leftcert=my-host-certificate.pem
leftid=@my-host-name
right=%any
rightsourceip=192.168.2.0/24
rightauth=eap-mschapv2
rightsendcert=never
eap_identity=%any
rekey=no
dpdaction=clear
dpddelay=300s
auto=add

You must have built StrongSwan with:

$ ./configure --enable-kernel-pfkey --enable-kernel-pfroute
--disable-kernel-netlink --disable-tools --disable-scripts
--with-group=wheel --enable-eap-gtc --enable-xauth-pam
--enable-eap-mschapv2 --enable-md4 --enable-eap-identity

I have both Windows 7 and BlackBerry 10 clients working against this
without problems.